block 2: security & auth hardening (CSP, baseline headers, config validation, secret redaction, req_id slog)

[aksOps]

Summary

Implements Block 2 of the docsiq production-polish roadmap. Five independent server-side changes that harden the HTTP boundary and config loader.

• 2.1 CSP header (Task 3) — securityHeadersMiddleware sets a strict CSP on every non-OPTIONS response, wired as the outermost router wrapper so 401/404/500 responses also carry it.
• 2.2 Baseline security headers (Task 4) — extends the same middleware with X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy (disables camera/mic/geo/payment/usb), and Strict-Transport-Security gated by server.hsts_enabled (default off; operators behind TLS set DOCSIQ_SERVER_HSTS_ENABLED=true).
• 2.3 Secret scrubbing (Task 2) — Config.Redact() + secret:"true" struct tag on every api_key field; reflective deep-copy zeroes tagged strings. Audited existing log sites — no whole-struct log sites found, so no log-call changes were required. Helper is available for future code.
• 2.4 Config validation (Task 1) — viper.UnmarshalExact rejects unknown/stale YAML keys at startup; validateLLM enforces per-provider minimums (Azure endpoint + api_key + api_version; OpenAI api_key; Ollama base_url). "none" and empty provider are accepted as explicit opt-out.
• 2.5 Request-ID slog threading (Task 5) — additive ContextLogger(ctx) helper returns slog.Default().With("req_id", id) when the context carries a request ID. Refactored 4 representative error-path log sites in handlers.go (writeError 5xx, upload invalid-filename, upload path-traversal, oversize upload rejection). Full sweep deferred to Block 4 observability work.

Plan deviations

1. validateLLM accepts "none" in addition to "" (existing code treats provider: "none" as explicit LLM opt-out with a test — TestProviderNone — which the plan's validator would have broken).
2. TestLoad_ValidatesLLMProvider/ollama_missing_base_url uses explicit base_url: "" in YAML because the default ollama.base_url = http://localhost:11434 makes "plain absence of key" a passing config.
3. Pre-existing config_file_load_yaml subtest loaded an Azure config with no endpoint/api_key; updated it to include both so the new validator passes.
4. Fixed pre-existing gofmt drift in internal/config/config.go (drift pre-dated Block 2; fixed because Tasks 1/2/4 were all touching this file).
5. Playwright smoke (Task 3 Step 7) not run locally; CI Playwright job will catch any CSP-triggered regression. Vitest UI suite (54 tests) ran locally and passed.

Test plan

• CGO_ENABLED=1 go test -tags sqlite_fts5 -timeout 300s ./... - all packages pass
• CGO_ENABLED=1 go test -tags sqlite_fts5 -race ./internal/api/ ./internal/config/ - pass
• go vet -tags sqlite_fts5 ./... - clean
• gofmt -l on touched files - clean
• cd ui && npm test -- --run - 54/54 pass
• CI Playwright smoke on main post-merge (gates CSP against the SPA)

Follow-ups (later blocks)

• Block 4 (observability): wider sweep refactoring remaining slog.* sites in handlers to ContextLogger(r.Context()).
• Block 4: consider ULID vs hex for request IDs (currently 16-char hex from crypto/rand — collision-safe for air-gapped single-binary deploy; not worth changing now).